If the HTTP status code is 5xx, keep the password. If the HTTP status code is 4xx, delete the password. Obviously making some assumptions (like HTTP, or a 5xx

If the HTTP status code is 5xx, keep the password. If the HTTP status code is 4xx, delete the password. Obviously making some assumptions (like HTTP, or a 5xx on network fail between internal services), but telling the difference between "user supplied bad data" and "the server messed up" really isn't that awkward at all.